AtmarkSAFE
Email for AI agents — its own address, not your Gmail. MCP client configs and examples for Atmark (invite-only).
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Invite-only. Email for AI agents — its own address, not your Gmail. Route alerts and notifications to it, and decide who it can write to. Requires an API token. Works with MCP clients that support remote HTTP with a Bearer token.
[Request access](https://atmark.ai/waitlist?ref=github) · Docs · atmark.ai
The Atmark service is not open source. This repo holds client configs and examples (MIT).
What your agent gets
- Its own address —
[email protected], separate from your inbox. No OAuth into your Gmail. - Sending you control — switch outbound to an allowlist and the agent writes only to people you add; everyone else is refused with
recipient_not_allowlisted. The agent can ask for a change withrequest_policy_change, and nothing changes until you approve it in the console. - Received mail marked as data — the sender's words arrive inside an outside-data block, and every email carries
risk.level. After reading a risky email, a send to someone new waits for your approval. - A record — every send decision and received-mail verdict joins a public, hash-chained transparency log at
id.atmark.ai/log, with a signed checkpoint every hour and a daily Bitcoin timestamp (OpenTimestamps). The log holds hashes, never mail contents.
Security
- The only Atmark MCP endpoint is `https://api.atmark.ai/mcp`. Anything else claiming to be Atmark isn't.
- Authentication is a header only:
Authorization: Bearer atk_agent_.... Issue tokens in the console; the value is shown once. - Never write the token into a config file that can be committed. Every config here reads it from the
ATMARK_AGENT_TOKENenvironment variable. - Report abuse to
[email protected].
Connect
Set the token in your shell without it showing on screen or in history:
read -rs ATMARK_AGENT_TOKEN && export ATMARK_AGENT_TOKEN
Claude Code
claude mcp add --transport http atmark https://ap
532c89ca0139OBSERVED · 2026-10-13Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (2)
streamable-http
Gates applied: no_behavioural_pass.
532c89ca0139full audit observations/trust-audit/mcp-server/atmark-ai__atmark.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | 532c89ca0139 | SAFE | B | 89 | first audit |
Questions
What is the Atmark MCP server?
Email for AI agents — its own address, not your Gmail. MCP client configs and examples for Atmark (invite-only).
Is Atmark safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Atmark need?
No credential environment variables were found in its source, so it appears to need none.
How does Atmark run?
It speaks streamable-http, so it runs as a service you connect to over the network.
How current is this page?
The grade is for one exact copy of the source (532c89ca0139), read on 2026-10-13. The repository is watched and re-audited when it changes.